Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About 3ffdot
3ffdot
Here to help
Member since Sep 26, 2017
Apr 10 2019
Community Record
19
Posts
0
Kudos
1
Solution
Badges
Apr 10 2019
6:45 AM
@PhilipDAth I have a similar scenario but the MX would be in front of just one of my spokes and not the hub. We have a site where an MX is being put in place but the router at the site is a DMVPN spoke. The MX is simply being put there as a firewall/security appliance but it would be in front of the DMVPN. Can this be done?
... View more
May 9 2018
7:59 AM
@PhilipDAth Very interesting setup. Do I create a layer 3 VLAN in VLAN 300 as well? It also has a static IP currently.
... View more
May 1 2018
12:15 PM
@Adam I thought about going that route and putting layer 3 IP's on the MX but I'm not sure it works as an actual router. I don't think you can assign more that one WAN IP to the MX.
... View more
May 1 2018
11:54 AM
I currently have a Cisco 2811 setup at one of our branches. It has an MPLS and internet connection on the fastethernet interface using subinterfaces (one physical connection). I want to know if the MX can be setup in the same manner. It doesn't seem to have this feature on it for subinterfaces but I might be missing it. I have the router interface config and the static routes below, any advice would be helpful. IP's are just for example purposes. interface FastEthernet0/0.300 description **INTERNET** encapsulation dot1Q 300 ip address 21.21.21.106 255.255.255.252 ip access-group INTERNET in ip nat outside ip virtual-reassembly end interface FastEthernet0/0.200 description **MPLS** encapsulation dot1Q 200 ip address 11.11.11.10 255.255.255.248 end ip route 0.0.0.0 0.0.0.0 216.81.55.105<---Internet ip route 10.0.0.0 255.0.0.0 100.64.1.9<---MPLS ip route 172.16.0.0 255.240.0.0 100.64.1.9<---MPLS ip route 192.168.0.0 255.255.0.0 100.64.1.9<---MPLS
... View more
Mar 19 2018
10:12 AM
@benny I just setup an MX84 behind an ASA and in front of a layer 3 switch. I used the 15.4 firmware as well and from my experience the MX isn't quite a layer 3 device even with the new firmware. For the MX to work and pass all traffic from WAN to LAN, you'll need to utilize static routes to the layer 3 device that all of your clients site behind. So as an example you would have a 66.10.10.1/30 and that goes to your WAN with the gateway being the next hope router. Then you have a 11.11.11.1/30 on the MX and that goes to your layer 3 switch. The switch should have a default route of the MX address (11.11.11.1). This way the WAN and LAN are separate and the MX is able to route traffic to the LAN by using the 11.11.11.x subnet. As I said, the MX isn't quite a layer 3 device so it takes a bit of engineering to get it to work like you want.
... View more
Mar 15 2018
7:01 AM
@jdsilva I see, ok well I have time this evening so I'm going to take a look at this and set it up. Is your second IP address tied to an interface or is it simply one of the VLAN's you added to the MX? Thanks for your responses.
... View more
Mar 13 2018
8:34 AM
@jdsilva I guess my concern is this MX actually working with Cisco. You're saying that you don't actually have a layer 3 address on the NO NAT MX? It looks like you're using the management IP of the MX for routing. With the IP's that are behind the MX, do you have them tagged on whatever port goes to your LAN and is the IP of the NO NAT MX on the same subnet as the layer 3 switch that it's connected to? If I put a subinterface on my ASA with the same subnet as the NO NAT MX that should be enough given that the ASA already has a route to the layer 3 switch. How does the MX know though? The reason for all my questions is that this is on an active network and I don't want a long outage for a solution that might not even be viable for this type of topology.
... View more
Mar 13 2018
8:19 AM
@jdsilva Right, I get that and I've done that too but how is your MX actually setup? Do you have layer 3 addresses on it, do you have routes setup on it? From what I've read and talking to support, the MX doesn't actually work as a layer 3 device unless it is replacing your end point router or firewall.
... View more
Mar 13 2018
5:20 AM
@jdsilva I have ASA---MX---Layer 3 switch. The MX doesn't seem to truly be a layer 3 device. How exactly did you set yours up as a layer 3 device?
... View more
Mar 8 2018
12:28 PM
@PhilipDAth I've been reading up about that actually and I've requested the Beta firmware from support. This is a much needed feature.
... View more
Mar 8 2018
6:40 AM
@Uberseehandel I have this same question in deploying the MX appliance behind an ASA. I don't want to NAT twice, I just want the MX to be a layer 3 device. I'm interested in the answer to this.
... View more
Mar 8 2018
6:32 AM
I have an MX84 that is currently in passthrough mode and behind a Cisco ASA and in front of a Cisco layer 3 switch. When in passthrough mode the MX sources all of its traffic out of the WAN interface which isn't helpful when it needs to reach the AD server that is behind the layer 3 switch. I want to put it in "NAT Mode" so that it becomes a layer 3 device however I don't want it to NAT anything since the ASA is handling all of that. Is it possible to get the MX to be a layer 3 device without having to NAT all traffic to its WAN interface?
... View more
Mar 1 2018
10:14 AM
Yea, it was connected at for a while but I changed the connections between the layer 3 switch and the ASA. Since then, the connection to the AD server has failed. It's like the MX can use the LAN connection to locate the server since it's on a different subnet.
... View more
Mar 1 2018
8:09 AM
I have an MX in between a layer 3 switch and an ASA. The MX is unable to connect to the AD server which is on a different subnet. It is able to ping the server and both the switch and ASA have paths to the AD server so I'm not sure why it isn't able to connect. Since I have the MX setup in passthrough mode, I'm not able to set and static routes on the appliance.
... View more
Feb 28 2018
7:42 AM
I traced the cables and changed the physical connections. L3 now goes into the MX and then to the ASA. Thanks for your response.
... View more
Feb 27 2018
1:24 PM
I have an MX84 in passthrough mode. The "internet" port is connected to my Layer 3 Cisco switch and port 3 is connected to my ASA. Traffic passes through just fine however on the client list, it seems to only be showing external IP addresses and nothing coming from my internal LAN. The only internal IP that it shows is the IP of my ASA. I need to be able to select clients in order to test the content filtering with the Active Directory groups.
... View more
Sep 27 2017
5:46 AM
That is exactly what I did last night after thinking it through. Thank you for your reply.
... View more
Sep 26 2017
12:35 PM
As a test, if I plug in a laptop to one of the ports it hands out a DHCP address in the same VLAN as the MX but I don't want it to hand out anything to the L3 switch I just want traffic to go through it. I though about plugging the uplink of the L3 switch (currently goes to the ASA) to the MX only, is that what you are suggesting?
... View more
Sep 26 2017
12:25 PM
I would like to setup my MX84 in passthrough mode behind my Cisco ASA and into a layer 3 switch. I have it configured as a passthrough from the dashboard but it the physical connections to the ASA and the layer 3 switch are where it isn't working as expected. The MX need an IP from the WAN 1 connection but it also need two other connections to the ASA and layer 3 switch respectively. The current documentation doesn't clearly explain.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 5231 | Mar 8 2018 12:28 PM |
© 2024 Cisco Systems, Inc.
